CVE-2026-105741High· 7.1▾ MidnightPoC available

Langflow is a tool for building and deploying AI-powered agents and workflows

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score51/ 100 · Moderate

impact 39.1 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Oct 5, 2026

Updated

Oct 6, 2026

CVSS

7.1

Vendor

langflow-ai

Product

langflow

CWE

CWE-290, CWE-345

Depth score

51 · Moderate

EPSS

0.24% · p16

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

CISA SSVC

decided 2026-10-06

Exploitation: poc
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 6.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 21 days

Oct 5, 2026Published
Disclosed via NVD
Oct 6, 2026Record revised
Last analysed / modified upstream
Oct 6, 2026EPSS first tracked
0.2%
Oct 6, 2026Public exploit observed
Exploit / PoC code exists
Oct 26, 2026EPSS peak
0.2% → 0.2%

langflow-ai CWE-290 CWE-345 #nvd #cve.org #exploit-available #ghsa #pip #osv

Affected

langflow >= 1.5.0, < 1.10.3

Patched in

langflow 1.10.3

Full technical detail▾

Overview

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-105741)

Affected packages:

langflow >= 1.5.0, < 1.10.3

Patched in:

langflow 1.10.3

Source: https://github.com/advisories/GHSA-4f6c-2vvp-gw82

References

Change history

Field changes observed since this record was first indexed.

Oct 6, 2026Public exploit / PoC published

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#exploit-available#ghsa#pip#osv

← Back to feed